@slicedearth/whoisleuth-cli 1.45.0 → 2.0.0

package/packages/contracts/case-portability.mjs

@@ -0,0 +1,1310 @@
+import { MAX_DOMAIN_NAME_LENGTH } from "./domain-name.mjs";
+import { defineSchemaCompatibility } from "./schema-compatibility.mjs";
+import { defineSchemaLifecycleFamily } from "./schema-lifecycle.mjs";
+export const CASE_CONTRACT_OWNER = 'packages/contracts/case-portability.mts';
+export const CASE_PORTABILITY_IDENTITY_CONSTANTS = Object.freeze([
+    'CASE_BROWSER_STORE_LIFECYCLE_SCHEMA',
+    'CASE_EXPORT_LIFECYCLE_SCHEMA',
+    'CASE_SCHEMA_VERSION',
+    'CASE_BROWSER_SUPPORTED_VERSIONS',
+    'CASE_IMPORT_VERSIONS',
+    'CASE_REPORT_SCHEMA',
+    'CASE_REPORT_SCHEMA_VERSION',
+    'CASE_REPORT_OUTPUT_VERSIONS',
+    'CASE_RESPONSE_PACKET_SCHEMA',
+    'CASE_RESPONSE_PACKET_VERSION',
+    'CASE_RESPONSE_PACKET_OUTPUT_VERSIONS',
+    'SUPPORTED_CASE_RESPONSE_PACKET_VERSIONS',
+    'CASE_RESPONSE_REVIEW_INPUTS_SCHEMA',
+    'CASE_RESPONSE_REVIEW_INPUTS_VERSION',
+    'CLI_CASE_PACK_SCHEMA',
+    'CLI_CASE_PACK_VERSION',
+    'SUPPORTED_CLI_CASE_PACK_VERSIONS',
+    'CLI_CASE_PACK_CASE_REPORT_EPOCHS',
+    'WORKSPACE_ARCHIVE_SCHEMA',
+    'PUBLIC_WORKSPACE_ARCHIVE_VERSION',
+    'WORKSPACE_ARCHIVE_VERSION',
+    'SUPPORTED_WORKSPACE_ARCHIVE_VERSIONS',
+    'PUBLIC_WORKSPACE_ARCHIVE_SECTION_IDS',
+    'WORKSPACE_ARCHIVE_SECTION_IDS',
+    'WORKSPACE_ARCHIVE_CASE_SECTION',
+    'WORKSPACE_SETTINGS_SCHEMA',
+    'WORKSPACE_SETTINGS_VERSION',
+    'ENCRYPTED_WORKSPACE_ARCHIVE_SCHEMA',
+    'ENCRYPTED_WORKSPACE_ARCHIVE_VERSION',
+]);
+export const CASE_PORTABILITY_BOUND_CONSTANTS = Object.freeze([
+    'MAX_CASES',
+    'MAX_NOTES_PER_CASE',
+    'MAX_NOTE_LENGTH',
+    'MAX_TAGS_PER_CASE',
+    'MAX_CASE_IMPORT_BYTES',
+    'MAX_CASE_STORE_BYTES',
+    'MAX_EVIDENCE_SNAPSHOTS_PER_CASE',
+    'MAX_EVIDENCE_FACTORS',
+    'MAX_EVIDENCE_NAMESERVERS',
+    'MAX_EVIDENCE_MUTATIONS',
+    'MAX_EVIDENCE_STRING_LENGTH',
+    'MAX_EVIDENCE_TITLE_LENGTH',
+    'MAX_EVIDENCE_DETAIL_LENGTH',
+    'MAX_EVIDENCE_CHANGES',
+    'MAX_CASE_BRAND_PROFILE_IDS',
+    'MAX_CASE_BRAND_PROFILE_ID_CANDIDATES',
+    'MAX_CASE_EVIDENCE_PINS',
+    'MAX_CASE_CHECKPOINT_FACTS',
+    'MAX_CASE_DECISIONS',
+    'MAX_CASE_ACTIONS',
+    'MAX_CASE_ACTION_EVENTS_PER_ACTION',
+    'MAX_CASE_ACTION_EVENTS_PER_CASE',
+    'MAX_CASE_ACTION_BYTES',
+    'MAX_CASE_ACTION_HISTORY_BYTES_PER_CASE',
+    'MAX_CASE_OBSERVED_EFFECT_REVIEWS',
+    'MAX_CASE_CLOSURES',
+    'MAX_CASE_ASSERTIONS',
+    'MAX_CASE_MANUAL_TRAIL_EVENTS',
+    'MAX_CASE_SIGHTINGS',
+    'MAX_RESPONSE_LABEL_LENGTH',
+    'MAX_RESPONSE_VALUE_LENGTH',
+    'MAX_RESPONSE_RATIONALE_LENGTH',
+    'MAX_RESPONSE_RECIPIENT_LENGTH',
+    'MAX_RESPONSE_REFERENCE_LENGTH',
+    'MAX_RESPONSE_LIMITATIONS',
+    'MAX_RESPONSE_LIMITATION_LENGTH',
+    'MAX_DECISION_PIN_REFERENCES',
+    'MAX_TRAIL_TARGET_LENGTH',
+    'MAX_ASSERTION_PROVENANCE_LABELS',
+    'MAX_ASSERTION_PROVENANCE_MARKINGS',
+    'MAX_ABUSIVE_URLS',
+    'MAX_RESPONSE_CONTACTS',
+    'MAX_RESPONSE_ACTION_HISTORY',
+    'MAX_RESPONSE_HARM_LENGTH',
+    'MAX_AFFECTED_PARTY_LENGTH',
+    'MAX_ABUSE_CATEGORY_LENGTH',
+    'MAX_EXACT_URL_LENGTH',
+    'MAX_RESPONSE_ARTEFACT_REFERENCES',
+    'MAX_RESPONSE_SELECTED_EVIDENCE',
+    'MAX_RESPONSE_CONTRADICTIONS',
+    'RESPONSE_ROUTE_STALE_AFTER_DAYS',
+    'MAX_RESPONSE_AUTHORISATION_CLOCK_SKEW_MS',
+    'MAX_CASE_PACK_INPUT_BYTES',
+    'MAX_CASE_PACK_CASES',
+    'MAX_WORKSPACE_ARCHIVE_BYTES',
+    'MAX_WORKSPACE_ARCHIVE_SECTION_BYTES',
+    'MAX_WORKSPACE_ARCHIVE_SECTIONS',
+    'WORKSPACE_ARCHIVE_PBKDF2_ITERATIONS',
+    'MIN_WORKSPACE_ARCHIVE_PASSPHRASE_CHARACTERS',
+    'MAX_WORKSPACE_ARCHIVE_PASSPHRASE_BYTES',
+    'MAX_ENCRYPTED_WORKSPACE_ARCHIVE_BYTES',
+]);
+export const CASE_DOMAIN_COMPATIBILITY_FACADES = Object.freeze([
+    ['frontend/src/lib/analysis/case-brand-profile-references.ts', 'packages/cases/case-brand-profile-references.mts'],
+    ['frontend/src/lib/analysis/case-evidence-model.ts', 'packages/cases/case-evidence-model.mts'],
+    ['frontend/src/lib/analysis/case-investigation-branch-model.ts', 'packages/cases/case-investigation-branch-model.mts'],
+    ['frontend/src/lib/analysis/case-migration-model.ts', 'packages/cases/case-migration-model.mts'],
+    ['frontend/src/lib/analysis/case-model.ts', 'packages/cases/case-model.mts'],
+    ['frontend/src/lib/analysis/case-record-contracts.ts', 'packages/cases/case-record-contracts.mts'],
+    ['frontend/src/lib/analysis/case-record-core.ts', 'packages/cases/case-record-core.mts'],
+    ['frontend/src/lib/analysis/case-record-model.ts', 'packages/cases/case-record-model.mts'],
+    ['frontend/src/lib/analysis/case-record-operations.ts', 'packages/cases/case-record-operations.mts'],
+    ['frontend/src/lib/analysis/case-report.ts', 'packages/cases/case-report.mts'],
+    ['frontend/src/lib/analysis/case-response-model.ts', 'packages/cases/case-response-model.mts'],
+    ['frontend/src/lib/analysis/case-response-packet.ts', 'packages/cases/case-response-packet.mts'],
+    ['frontend/src/lib/analysis/case-storage-model.ts', 'packages/cases/case-storage-model.mts'],
+    ['frontend/src/lib/analysis/http-summary.ts', 'packages/cases/http-summary.mts'],
+    ['frontend/src/lib/analysis/opaque-reference-id.ts', 'packages/cases/opaque-reference-id.mts'],
+    ['frontend/src/lib/analysis/workspace-archive.ts', 'packages/workspace/workspace-archive.mts'],
+    ['frontend/src/lib/analysis/workspace-archive-crypto.ts', 'packages/workspace/workspace-archive-crypto.mts'],
+]);
+export const CASE_DOMAIN_RUNTIME_ADAPTERS = Object.freeze([
+    'frontend/src/lib/cases.ts',
+    'frontend/src/lib/workspace-archive.ts',
+]);
+export const CASE_BROWSER_STORE_LIFECYCLE_SCHEMA = 'whoisleuth.browser.case-store';
+export const CASE_EXPORT_LIFECYCLE_SCHEMA = 'whoisleuth.case-export';
+export const PUBLIC_CASE_SCHEMA_VERSION = 12;
+export const CASE_SCHEMA_VERSION = 13;
+export const CASE_BROWSER_SUPPORTED_VERSIONS = Object.freeze([PUBLIC_CASE_SCHEMA_VERSION, CASE_SCHEMA_VERSION]);
+export const CASE_IMPORT_VERSIONS = CASE_BROWSER_SUPPORTED_VERSIONS;
+export const CASE_REPORT_SCHEMA = 'whoisleuth.case-report';
+export const PUBLIC_CASE_REPORT_SCHEMA_VERSION = 8;
+export const CASE_REPORT_SCHEMA_VERSION = 9;
+export const CASE_REPORT_OUTPUT_VERSIONS = Object.freeze([CASE_REPORT_SCHEMA_VERSION]);
+export const CASE_RESPONSE_PACKET_SCHEMA = 'whoisleuth.case-response-packet';
+export const PUBLIC_CASE_RESPONSE_PACKET_VERSION = 6;
+export const CASE_RESPONSE_PACKET_VERSION = 7;
+export const CASE_RESPONSE_PACKET_OUTPUT_VERSIONS = Object.freeze([PUBLIC_CASE_RESPONSE_PACKET_VERSION, CASE_RESPONSE_PACKET_VERSION]);
+export const SUPPORTED_CASE_RESPONSE_PACKET_VERSIONS = CASE_RESPONSE_PACKET_OUTPUT_VERSIONS;
+export const CASE_RESPONSE_REVIEW_INPUTS_SCHEMA = 'whoisleuth.case-response-review-inputs';
+export const CASE_RESPONSE_REVIEW_INPUTS_VERSION = 1;
+export const CLI_CASE_PACK_SCHEMA = 'whoisleuth.cli.case-pack';
+export const CLI_CASE_PACK_VERSION = 2;
+export const SUPPORTED_CLI_CASE_PACK_VERSIONS = Object.freeze([CLI_CASE_PACK_VERSION]);
+export const CLI_CASE_PACK_ROOT_KEYS = Object.freeze(['version', 'exportedAt', 'cases', 'packet', 'integrity']);
+export const CLI_CASE_PACK_PACKET_KEYS = Object.freeze(['schema', 'version', 'audience', 'reviewed', 'reports', 'redactionManifest', 'limitations']);
+export const CLI_CASE_PACK_PUBLIC_REPORT_KEYS = Object.freeze(['schema', 'schemaVersion', 'generatedAt', 'application', 'case', 'currentAssessment', 'evidenceTimeline', 'analystResponse', 'limitations']);
+export const CLI_CASE_PACK_REPORT_KEYS = Object.freeze(['schema', 'schemaVersion', 'generatedAt', 'application', 'case', 'currentAssessment', 'evidenceTimeline', 'analystResponse', 'responseLifecycle', 'limitations']);
+export const CLI_CASE_PACK_INTEGRITY_KEYS = Object.freeze(['algorithm', 'canonicalization', 'digestSha256']);
+export const CLI_CASE_PACK_CURRENT_REDACTION_KEYS = Object.freeze(['excluded', 'sourceCaseCount', 'brandProfileReferencesOmitted']);
+export const CLI_CASE_PACK_LIMITATIONS = Object.freeze([
+    'This local package is browser-importable through its top-level case collection and does not upload or submit evidence.',
+    'The reviewed flag records a deliberate CLI choice; it does not prove recipient authorisation, factual correctness, or legal sufficiency.',
+    'Importing the package does not restore fields excluded by its audience profile.',
+]);
+export const CLI_CASE_PACK_CASE_REPORT_EPOCHS = Object.freeze([
+    Object.freeze({ caseVersions: Object.freeze([PUBLIC_CASE_SCHEMA_VERSION]), reportVersions: Object.freeze([PUBLIC_CASE_REPORT_SCHEMA_VERSION]) }),
+    Object.freeze({ caseVersions: Object.freeze([CASE_SCHEMA_VERSION]), reportVersions: Object.freeze([CASE_REPORT_SCHEMA_VERSION]) }),
+]);
+export function caseReportVersionMatchesCase(caseVersion, reportVersion) {
+    return typeof reportVersion === 'number'
+        && Number.isSafeInteger(reportVersion)
+        && CLI_CASE_PACK_CASE_REPORT_EPOCHS.some((epoch) => (epoch.caseVersions.some((version) => version === caseVersion)
+            && epoch.reportVersions.some((version) => version === reportVersion)));
+}
+export const WORKSPACE_ARCHIVE_SCHEMA = 'whoisleuth.workspace-archive';
+export const PUBLIC_WORKSPACE_ARCHIVE_VERSION = 5;
+export const WORKSPACE_ARCHIVE_VERSION = 6;
+export const SUPPORTED_WORKSPACE_ARCHIVE_VERSIONS = Object.freeze([PUBLIC_WORKSPACE_ARCHIVE_VERSION, WORKSPACE_ARCHIVE_VERSION]);
+export function isSupportedWorkspaceArchiveVersion(value) {
+    return typeof value === 'number'
+        && Number.isSafeInteger(value)
+        && SUPPORTED_WORKSPACE_ARCHIVE_VERSIONS.some((version) => version === value);
+}
+export const WORKSPACE_ARCHIVE_SECTION_IDS = Object.freeze([
+    'cases', 'campaigns', 'brandProfiles', 'watchlists', 'shortlist', 'detectionRules',
+    'relationshipObservations', 'bulkSessions', 'websiteSnapshots', 'investigationTemplates',
+    'bulkReview', 'analystReviewState', 'settings',
+]);
+export const PUBLIC_WORKSPACE_ARCHIVE_SECTION_IDS = Object.freeze(WORKSPACE_ARCHIVE_SECTION_IDS.filter((id) => id !== 'analystReviewState'));
+export const WORKSPACE_ARCHIVE_CASE_SECTION = Object.freeze({
+    id: 'cases',
+    schema: null,
+    currentVersion: CASE_SCHEMA_VERSION,
+    supportedVersions: CASE_IMPORT_VERSIONS,
+});
+export const WORKSPACE_SETTINGS_SCHEMA = 'whoisleuth.workspace-settings';
+export const WORKSPACE_SETTINGS_VERSION = 1;
+export const ENCRYPTED_WORKSPACE_ARCHIVE_SCHEMA = 'whoisleuth.encrypted-workspace-archive';
+export const ENCRYPTED_WORKSPACE_ARCHIVE_VERSION = 1;
+export const CASE_PORTABILITY_VERIFIER_DISPATCH = Object.freeze([
+    Object.freeze({
+        id: 'case-response-packet',
+        artifactKind: 'case_response_packet',
+        schema: CASE_RESPONSE_PACKET_SCHEMA,
+        discriminator: 'root_schema',
+        versionField: 'schemaVersion',
+        supportedVersions: SUPPORTED_CASE_RESPONSE_PACKET_VERSIONS,
+        structureHookId: 'case.packet.structure',
+        integrityHookId: 'case.packet.verify',
+    }),
+    Object.freeze({
+        id: 'cli-case-pack',
+        artifactKind: 'cli_case_pack',
+        schema: CLI_CASE_PACK_SCHEMA,
+        discriminator: 'packet_schema',
+        versionField: 'packet.version',
+        supportedVersions: SUPPORTED_CLI_CASE_PACK_VERSIONS,
+        structureHookId: 'case.cli-pack.verify',
+        integrityHookId: 'case.cli-pack.verify',
+    }),
+]);
+export const MAX_CASES = 500;
+export const MAX_NOTES_PER_CASE = 50;
+export const MAX_NOTE_LENGTH = 2000;
+export const MAX_TAGS_PER_CASE = 20;
+export const MAX_TAG_LENGTH = 40;
+export const MAX_DOMAIN_LENGTH = MAX_DOMAIN_NAME_LENGTH;
+export const MAX_CASE_IMPORT_BYTES = 2 * 1024 * 1024;
+export const MAX_CASE_STORE_BYTES = 4 * 1024 * 1024;
+export const MAX_EVIDENCE_SNAPSHOTS_PER_CASE = 25;
+export const MAX_EVIDENCE_FACTORS = 20;
+export const MAX_EVIDENCE_NAMESERVERS = 12;
+export const MAX_EVIDENCE_MUTATIONS = 20;
+export const MAX_EVIDENCE_STRING_LENGTH = 200;
+export const MAX_EVIDENCE_TITLE_LENGTH = 200;
+export const MAX_EVIDENCE_DETAIL_LENGTH = 200;
+export const MAX_EVIDENCE_CHANGES = 40;
+export const MAX_CASE_BRAND_PROFILE_IDS = 8;
+export const MAX_CASE_BRAND_PROFILE_ID_CANDIDATES = 32;
+export const MAX_CASE_EVIDENCE_PINS = 40;
+export const MAX_CASE_CHECKPOINT_FACTS = 20;
+export const MAX_CASE_DECISIONS = 30;
+export const MAX_CASE_ACTIONS = 50;
+export const MAX_CASE_ACTION_EVENTS_PER_ACTION = 40;
+export const MAX_CASE_ACTION_EVENTS_PER_CASE = 400;
+export const MAX_CASE_ACTION_BYTES = 32 * 1024;
+export const MAX_CASE_ACTION_HISTORY_BYTES_PER_CASE = 512 * 1024;
+export const MAX_CASE_OBSERVED_EFFECT_REVIEWS = 40;
+export const MAX_CASE_CLOSURES = 12;
+export const MAX_CASE_ASSERTIONS = 50;
+export const MAX_CASE_MANUAL_TRAIL_EVENTS = 80;
+export const MAX_CASE_SIGHTINGS = 80;
+export const MAX_RESPONSE_LABEL_LENGTH = 80;
+export const MAX_RESPONSE_VALUE_LENGTH = 1000;
+export const MAX_RESPONSE_RATIONALE_LENGTH = 2000;
+export const MAX_RESPONSE_RECIPIENT_LENGTH = 320;
+export const MAX_RESPONSE_REFERENCE_LENGTH = 500;
+export const MAX_RESPONSE_LIMITATIONS = 8;
+export const MAX_RESPONSE_LIMITATION_LENGTH = 240;
+export const MAX_DECISION_PIN_REFERENCES = 20;
+export const MAX_TRAIL_TARGET_LENGTH = 500;
+export const MAX_ASSERTION_PROVENANCE_LABELS = 20;
+export const MAX_ASSERTION_PROVENANCE_MARKINGS = 12;
+export const MAX_ABUSIVE_URLS = 20;
+export const MAX_RESPONSE_CONTACTS = 12;
+export const MAX_RESPONSE_ACTION_HISTORY = 20;
+export const MAX_RESPONSE_HARM_LENGTH = 2000;
+export const MAX_AFFECTED_PARTY_LENGTH = 200;
+export const MAX_ABUSE_CATEGORY_LENGTH = 80;
+export const MAX_EXACT_URL_LENGTH = 2048;
+export const MAX_RESPONSE_ARTEFACT_REFERENCES = 12;
+export const MAX_RESPONSE_SELECTED_EVIDENCE = 20;
+export const MAX_RESPONSE_CONTRADICTIONS = 20;
+export const RESPONSE_ROUTE_STALE_AFTER_DAYS = 30;
+export const MAX_RESPONSE_AUTHORISATION_CLOCK_SKEW_MS = 300_000;
+export const MAX_CASE_PACK_INPUT_BYTES = 4 * 1024 * 1024;
+export const MAX_CASE_PACK_CASES = 25;
+export const MAX_WORKSPACE_ARCHIVE_BYTES = 10 * 1024 * 1024;
+export const MAX_WORKSPACE_ARCHIVE_SECTION_BYTES = 5 * 1024 * 1024;
+export const MAX_WORKSPACE_ARCHIVE_SECTIONS = 13;
+export const WORKSPACE_ARCHIVE_PBKDF2_ITERATIONS = 600_000;
+export const MIN_WORKSPACE_ARCHIVE_PASSPHRASE_CHARACTERS = 12;
+export const MAX_WORKSPACE_ARCHIVE_PASSPHRASE_BYTES = 1024;
+export const MAX_ENCRYPTED_WORKSPACE_ARCHIVE_BYTES = Math.ceil(MAX_WORKSPACE_ARCHIVE_BYTES * 4 / 3) + 4096;
+export const CASE_BROWSER_COMPATIBILITY = defineSchemaCompatibility({
+    id: 'browser.cases', kind: 'browser_store', schema: null, currentVersion: CASE_SCHEMA_VERSION,
+    supportedVersions: CASE_BROWSER_SUPPORTED_VERSIONS, acceptsUnversionedLegacy: false,
+    futureVersionBehavior: 'preserve_without_write', migration: 'normalize_to_current',
+    writeSemantics: 'normalized_rewrite', byteBudget: MAX_CASE_STORE_BYTES, owner: CASE_CONTRACT_OWNER,
+    note: 'The exact public version 12 writer migrates directly to version 13; other retired and all future stores remain untouched.',
+});
+export const CASE_EXPORT_COMPATIBILITY = defineSchemaCompatibility({
+    id: 'export.cases', kind: 'export', schema: null, currentVersion: CASE_SCHEMA_VERSION,
+    supportedVersions: CASE_IMPORT_VERSIONS, acceptsUnversionedLegacy: false,
+    futureVersionBehavior: 'reject', migration: 'normalize_to_current',
+    writeSemantics: 'non_destructive_merge', byteBudget: MAX_CASE_IMPORT_BYTES, owner: CASE_CONTRACT_OWNER,
+    note: 'Exact public Case version 12 and current version 13 merge non-destructively through one bounded reader; other versions fail without mutation.',
+});
+export const CASE_REPORT_COMPATIBILITY = defineSchemaCompatibility({
+    id: 'export.case-report', kind: 'export', schema: CASE_REPORT_SCHEMA, currentVersion: CASE_REPORT_SCHEMA_VERSION,
+    supportedVersions: CASE_REPORT_OUTPUT_VERSIONS, acceptsUnversionedLegacy: false,
+    futureVersionBehavior: 'not_applicable', migration: 'read_only', writeSemantics: 'read_only',
+    byteBudget: null, owner: CASE_CONTRACT_OWNER,
+    note: 'Case report version 9 is the durable output contract; retired and future report versions are unsupported.',
+});
+export const CASE_RESPONSE_PACKET_COMPATIBILITY = defineSchemaCompatibility({
+    id: 'export.case-response-packet', kind: 'export', schema: CASE_RESPONSE_PACKET_SCHEMA,
+    currentVersion: CASE_RESPONSE_PACKET_VERSION, supportedVersions: CASE_RESPONSE_PACKET_OUTPUT_VERSIONS,
+    acceptsUnversionedLegacy: false, futureVersionBehavior: 'reject', migration: 'read_only',
+    writeSemantics: 'read_only', byteBudget: null, owner: CASE_CONTRACT_OWNER,
+    note: 'Exact public packet version 6 and current version 7 are verified independently; other versions fail closed.',
+});
+export const CASE_RESPONSE_REVIEW_INPUTS_COMPATIBILITY = defineSchemaCompatibility({
+    id: 'derived.case-response-review-inputs', kind: 'derived', schema: CASE_RESPONSE_REVIEW_INPUTS_SCHEMA,
+    currentVersion: CASE_RESPONSE_REVIEW_INPUTS_VERSION, supportedVersions: [CASE_RESPONSE_REVIEW_INPUTS_VERSION],
+    acceptsUnversionedLegacy: false, futureVersionBehavior: 'reject', migration: 'exact_current_only',
+    writeSemantics: 'read_only', byteBudget: null, owner: CASE_CONTRACT_OWNER,
+    note: 'Exact bounded review inputs are canonicalised with sorted-json-v2 for one response authorisation digest and reject extensions or future versions.',
+});
+export const CLI_CASE_PACK_COMPATIBILITY = defineSchemaCompatibility({
+    id: 'export.cli-case-pack', kind: 'export', schema: CLI_CASE_PACK_SCHEMA, currentVersion: CLI_CASE_PACK_VERSION,
+    supportedVersions: SUPPORTED_CLI_CASE_PACK_VERSIONS, acceptsUnversionedLegacy: false,
+    futureVersionBehavior: 'reject', migration: 'read_only', writeSemantics: 'read_only',
+    byteBudget: MAX_CASE_IMPORT_BYTES, owner: CASE_CONTRACT_OWNER,
+    note: 'Case-pack version 2 verifies the exact public Case 12/report 8 epoch and the current Case 13/report 9 epoch with deterministic sorted-json-v2 integrity.',
+});
+export const WORKSPACE_ARCHIVE_COMPATIBILITY = defineSchemaCompatibility({
+    id: 'export.workspace-archive', kind: 'export', schema: WORKSPACE_ARCHIVE_SCHEMA,
+    currentVersion: WORKSPACE_ARCHIVE_VERSION, supportedVersions: SUPPORTED_WORKSPACE_ARCHIVE_VERSIONS,
+    acceptsUnversionedLegacy: false, futureVersionBehavior: 'reject', migration: 'normalize_to_current',
+    writeSemantics: 'non_destructive_merge', byteBudget: MAX_WORKSPACE_ARCHIVE_BYTES, owner: CASE_CONTRACT_OWNER,
+    note: 'Workspace envelope version 6 adds the bounded analyst Review Item lifecycle section. Exact version 5 remains readable and migrates to an empty review-state section without inventing decisions; future envelopes fail without mutation.',
+});
+export const WORKSPACE_SETTINGS_COMPATIBILITY = defineSchemaCompatibility({
+    id: 'export.workspace-settings-section', kind: 'export', schema: WORKSPACE_SETTINGS_SCHEMA,
+    currentVersion: WORKSPACE_SETTINGS_VERSION, supportedVersions: [WORKSPACE_SETTINGS_VERSION],
+    acceptsUnversionedLegacy: false, futureVersionBehavior: 'reject', migration: 'exact_current_only',
+    writeSemantics: 'non_destructive_merge', byteBudget: null, owner: CASE_CONTRACT_OWNER,
+    note: 'Nested archive section limited to the active Brand Profile identifier and dark, light, or system theme preference.',
+});
+export const ENCRYPTED_WORKSPACE_ARCHIVE_COMPATIBILITY = defineSchemaCompatibility({
+    id: 'export.encrypted-workspace-archive', kind: 'export', schema: ENCRYPTED_WORKSPACE_ARCHIVE_SCHEMA,
+    currentVersion: ENCRYPTED_WORKSPACE_ARCHIVE_VERSION, supportedVersions: [ENCRYPTED_WORKSPACE_ARCHIVE_VERSION],
+    acceptsUnversionedLegacy: false, futureVersionBehavior: 'reject', migration: 'exact_current_only',
+    writeSemantics: 'non_destructive_merge', byteBudget: MAX_ENCRYPTED_WORKSPACE_ARCHIVE_BYTES,
+    owner: CASE_CONTRACT_OWNER,
+    note: 'Version 1 is the exact PBKDF2 and AES-GCM wrapper for supported ordinary workspace envelopes; passphrases remain transient.',
+});
+export const CASE_PORTABILITY_COMPATIBILITY = Object.freeze([
+    CASE_BROWSER_COMPATIBILITY, CASE_EXPORT_COMPATIBILITY, CASE_REPORT_COMPATIBILITY,
+    CASE_RESPONSE_PACKET_COMPATIBILITY, CASE_RESPONSE_REVIEW_INPUTS_COMPATIBILITY,
+    CLI_CASE_PACK_COMPATIBILITY, WORKSPACE_ARCHIVE_COMPATIBILITY,
+    WORKSPACE_SETTINGS_COMPATIBILITY,
+    ENCRYPTED_WORKSPACE_ARCHIVE_COMPATIBILITY,
+]);
+export function serialiseCasePortableJson(value) {
+    return `${JSON.stringify(value, null, 2)}\n`;
+}
+/** Canonical compact bytes used for workspace-section checksums and byte counts. */
+export function serialiseWorkspaceArchiveSection(value) {
+    const serialised = JSON.stringify(value);
+    if (typeof serialised !== 'string') {
+        throw new TypeError('Workspace archive sections must be JSON-serialisable documents.');
+    }
+    return serialised;
+}
+const CASE_LIFECYCLE_FIXTURES = Object.freeze([
+    Object.freeze({
+        id: 'browser-case-v12-public',
+        path: 'test/fixtures/case-lifecycle/browser-case-v12.json',
+        bytes: 1286,
+        sha256: '86d4f3be343034ff05f1214229294d9c6424ccc13fc63e884358fb691b2e0d4e',
+        contentDigestSha256: null,
+        schema: CASE_BROWSER_STORE_LIFECYCLE_SCHEMA,
+        version: PUBLIC_CASE_SCHEMA_VERSION,
+        role: 'historical',
+        expectation: 'normalises_to_current_output',
+        expectedOutputFixtureId: 'browser-case-v13',
+        shapeId: 'case.browser-store.public',
+        scope: 'repository',
+    }),
+    Object.freeze({
+        id: 'browser-case-v13',
+        path: 'test/fixtures/case-lifecycle/browser-case-v13.json',
+        bytes: 3096,
+        sha256: 'd679030e52340ecc7795ac88de15316d88c8c07b94b34da60fd52589a0375712',
+        contentDigestSha256: null,
+        schema: CASE_BROWSER_STORE_LIFECYCLE_SCHEMA,
+        version: CASE_SCHEMA_VERSION,
+        role: 'current',
+        expectation: 'accepted_exact',
+        expectedOutputFixtureId: null,
+        shapeId: 'case.browser-store.current',
+        scope: 'repository',
+    }),
+    Object.freeze({
+        id: 'case-export-v12-public',
+        path: 'test/fixtures/case-v12-response-lifecycle.json',
+        bytes: 1290,
+        sha256: 'c5182bc1d413a1e1940e06e158d8dde47971d3fb034090934fe600753ffd7f0b',
+        contentDigestSha256: null,
+        schema: CASE_EXPORT_LIFECYCLE_SCHEMA,
+        version: PUBLIC_CASE_SCHEMA_VERSION,
+        role: 'historical',
+        expectation: 'normalises_to_current_output',
+        expectedOutputFixtureId: 'case-export-v13',
+        shapeId: 'case.export.public',
+        scope: 'repository',
+    }),
+    Object.freeze({
+        id: 'case-export-v13',
+        path: 'test/fixtures/case-lifecycle/case-export-v13.json',
+        bytes: 3140,
+        sha256: 'fd2aa7623c2aaea385b952727ad74cf5af0f1ee21dc478c0e5c820a332376a0d',
+        contentDigestSha256: null,
+        schema: CASE_EXPORT_LIFECYCLE_SCHEMA,
+        version: CASE_SCHEMA_VERSION,
+        role: 'current',
+        expectation: 'accepted_exact',
+        expectedOutputFixtureId: null,
+        shapeId: 'case.export.current',
+        scope: 'repository',
+    }),
+    Object.freeze({
+        id: 'case-response-packet-v6-public',
+        path: 'test/fixtures/case-lifecycle/case-response-packet-v6.json',
+        bytes: 5100,
+        sha256: '32030d3941119dce378dc03f6b3f5d710ce3883e7253cd43fa322c989ff529cb',
+        contentDigestSha256: 'sha256:29a5185a3d944af38c9656706fe89d96e60f949e8684646a55c8bcd10de54746',
+        schema: CASE_RESPONSE_PACKET_SCHEMA,
+        version: PUBLIC_CASE_RESPONSE_PACKET_VERSION,
+        role: 'historical',
+        expectation: 'accepted_exact',
+        expectedOutputFixtureId: null,
+        shapeId: 'case.response-packet.v6',
+        scope: 'repository',
+    }),
+    Object.freeze({
+        id: 'case-report-v9',
+        path: 'test/fixtures/case-lifecycle/case-report-v9.json',
+        bytes: 2761,
+        sha256: 'd9903318123c63ae7a385f153286a5596585a401771c8def8149792b9b7b9326',
+        contentDigestSha256: null,
+        schema: CASE_REPORT_SCHEMA,
+        version: CASE_REPORT_SCHEMA_VERSION,
+        role: 'current',
+        expectation: 'accepted_exact',
+        expectedOutputFixtureId: null,
+        shapeId: 'case.report.v9',
+        scope: 'repository',
+    }),
+    Object.freeze({
+        id: 'case-response-packet-v7',
+        path: 'test/fixtures/case-lifecycle/case-response-packet-v7.json',
+        bytes: 10000,
+        sha256: '0ea150d920710b331839be0a0f995d4597a133ecb930ef850de1eecfca4d94e3',
+        contentDigestSha256: 'sha256:fa5b7f079882dd72b15365d844937ae99e47f81465e79b3911c25e70c157e562',
+        schema: CASE_RESPONSE_PACKET_SCHEMA,
+        version: CASE_RESPONSE_PACKET_VERSION,
+        role: 'current',
+        expectation: 'accepted_exact',
+        expectedOutputFixtureId: null,
+        shapeId: 'case.response-packet.v7',
+        scope: 'repository',
+    }),
+    Object.freeze({
+        id: 'case-response-review-inputs-v1',
+        path: 'test/fixtures/case-lifecycle/case-response-review-inputs-v1.json',
+        bytes: 5555,
+        sha256: '67d3d36f316cf17898e04c39f2ba0ba7599abdc4b4e387baef5f5866a73c7b9c',
+        contentDigestSha256: null,
+        schema: CASE_RESPONSE_REVIEW_INPUTS_SCHEMA,
+        version: CASE_RESPONSE_REVIEW_INPUTS_VERSION,
+        role: 'current',
+        expectation: 'accepted_exact',
+        expectedOutputFixtureId: null,
+        shapeId: 'case.response-review-inputs.v1',
+        scope: 'repository',
+    }),
+    Object.freeze({
+        id: 'cli-case-pack-v2-case-v12-public',
+        path: 'test/fixtures/case-lifecycle/cli-case-pack-v2-case-v12-public.json',
+        bytes: 4947,
+        sha256: '4c8117dfb73c1eed5bd3f4cf78bf350459cdcc8f406120f089b34e6a6fcbfc7c',
+        contentDigestSha256: 'sha256:93cc725c03052aa0232fb6965154c58810d8d1aef3ea0203e451a94bf9d091cf',
+        schema: CLI_CASE_PACK_SCHEMA,
+        version: CLI_CASE_PACK_VERSION,
+        role: 'current',
+        expectation: 'accepted_exact',
+        expectedOutputFixtureId: null,
+        shapeId: 'case.cli-pack.current',
+        scope: 'repository',
+    }),
+    Object.freeze({
+        id: 'cli-case-pack-v2-case-v13',
+        path: 'test/fixtures/case-lifecycle/cli-case-pack-v2-case-v13.json',
+        bytes: 9288,
+        sha256: '77b7bce093a967d04a2cf0ead3b715625c00903c4c194227c5b74886f2b847c6',
+        contentDigestSha256: 'sha256:2cda7f529ec9b5ec5234180c80286274dc0545b9ba360015b073ae3eb3e97f3d',
+        schema: CLI_CASE_PACK_SCHEMA,
+        version: CLI_CASE_PACK_VERSION,
+        role: 'current',
+        expectation: 'accepted_exact',
+        expectedOutputFixtureId: null,
+        shapeId: 'case.cli-pack.current',
+        scope: 'repository',
+    }),
+    Object.freeze({
+        id: 'workspace-archive-v5-public',
+        path: 'test/fixtures/case-lifecycle/workspace-archive-v5-public.json',
+        bytes: 5271,
+        sha256: '27fd5f590b493be1ce57708be8b5c11d95eb600ae54e1ed3a530e78db433ec0d',
+        contentDigestSha256: null,
+        schema: WORKSPACE_ARCHIVE_SCHEMA,
+        version: PUBLIC_WORKSPACE_ARCHIVE_VERSION,
+        role: 'historical',
+        expectation: 'normalises_to_current_output',
+        expectedOutputFixtureId: 'workspace-archive-v6-empty-current',
+        shapeId: 'case.workspace-archive.v5',
+        scope: 'repository',
+    }),
+    Object.freeze({
+        id: 'workspace-archive-v6-empty-current',
+        path: 'test/fixtures/case-lifecycle/workspace-archive-v6-empty-current.json',
+        bytes: 5557,
+        sha256: '7a0701c7b0401de76df132fe7b2332fd1e2f1fade007a8af0103c8cec5a1b2f9',
+        contentDigestSha256: null,
+        schema: WORKSPACE_ARCHIVE_SCHEMA,
+        version: WORKSPACE_ARCHIVE_VERSION,
+        role: 'current',
+        expectation: 'accepted_exact',
+        expectedOutputFixtureId: null,
+        shapeId: 'case.workspace-archive.v6',
+        scope: 'repository',
+    }),
+    Object.freeze({
+        id: 'workspace-settings-v1',
+        path: 'test/fixtures/case-lifecycle/workspace-settings-v1.json',
+        bytes: 110,
+        sha256: '75675baf68765da5d36e9911d106dd8b72a8fd3c859136b651411d8041a4e184',
+        contentDigestSha256: null,
+        schema: WORKSPACE_SETTINGS_SCHEMA,
+        version: WORKSPACE_SETTINGS_VERSION,
+        role: 'current',
+        expectation: 'accepted_exact',
+        expectedOutputFixtureId: null,
+        shapeId: 'case.workspace-settings.v1',
+        scope: 'repository',
+    }),
+    Object.freeze({
+        id: 'encrypted-workspace-archive-v1',
+        path: 'test/fixtures/case-lifecycle/encrypted-workspace-archive-v1.json',
+        bytes: 7502,
+        sha256: 'd7279ba0afb548d3ce41bdfc56acebffd05dc9b0b5b1451cb57a1164be881733',
+        contentDigestSha256: null,
+        schema: ENCRYPTED_WORKSPACE_ARCHIVE_SCHEMA,
+        version: ENCRYPTED_WORKSPACE_ARCHIVE_VERSION,
+        role: 'current',
+        expectation: 'accepted_exact',
+        expectedOutputFixtureId: null,
+        shapeId: 'case.encrypted-workspace-archive.v1',
+        scope: 'repository',
+    }),
+]);
+function fixtureIdsFor(schema, version) {
+    return Object.freeze(CASE_LIFECYCLE_FIXTURES
+        .filter((fixture) => fixture.schema === schema && fixture.version === version)
+        .map((fixture) => fixture.id));
+}
+function lifecycleContract(input) {
+    return { ...input, role: input.role ?? 'document', fixtureIds: fixtureIdsFor(input.schema, input.version) };
+}
+const browserContracts = CASE_BROWSER_SUPPORTED_VERSIONS.map((version) => lifecycleContract({
+    compatibilityId: CASE_BROWSER_COMPATIBILITY.id, schema: CASE_BROWSER_STORE_LIFECYCLE_SCHEMA, version,
+    lifecycle: version === CASE_SCHEMA_VERSION ? 'current' : 'legacy', readable: true,
+    emitted: version === CASE_SCHEMA_VERSION, exactKeys: false,
+    extensionPolicy: 'discard_bounded', futureVersionBehaviour: 'preserve_without_write',
+    migrationTarget: version === CASE_SCHEMA_VERSION ? null : { schema: CASE_BROWSER_STORE_LIFECYCLE_SCHEMA, version: CASE_SCHEMA_VERSION },
+    canonicalisation: null, byteBudget: MAX_CASE_STORE_BYTES,
+}));
+const exportContracts = CASE_IMPORT_VERSIONS.map((version) => lifecycleContract({
+    compatibilityId: CASE_EXPORT_COMPATIBILITY.id, schema: CASE_EXPORT_LIFECYCLE_SCHEMA, version,
+    lifecycle: version === CASE_SCHEMA_VERSION ? 'current' : 'legacy', readable: true,
+    emitted: version === CASE_SCHEMA_VERSION, exactKeys: true, extensionPolicy: 'reject',
+    futureVersionBehaviour: 'reject', migrationTarget: version === CASE_SCHEMA_VERSION
+        ? null
+        : { schema: CASE_EXPORT_LIFECYCLE_SCHEMA, version: CASE_SCHEMA_VERSION },
+    canonicalisation: null, byteBudget: MAX_CASE_IMPORT_BYTES,
+}));
+const reportContracts = CASE_REPORT_OUTPUT_VERSIONS.map((version) => lifecycleContract({
+    compatibilityId: CASE_REPORT_COMPATIBILITY.id, schema: CASE_REPORT_SCHEMA, version,
+    lifecycle: 'current', readable: false, emitted: true, exactKeys: true, extensionPolicy: 'reject',
+    futureVersionBehaviour: 'not_applicable', migrationTarget: null, canonicalisation: null, byteBudget: null,
+}));
+const packetContracts = CASE_RESPONSE_PACKET_OUTPUT_VERSIONS.map((version) => lifecycleContract({
+    compatibilityId: CASE_RESPONSE_PACKET_COMPATIBILITY.id, schema: CASE_RESPONSE_PACKET_SCHEMA, version,
+    lifecycle: version === CASE_RESPONSE_PACKET_VERSION ? 'current' : 'legacy', readable: true,
+    emitted: version === CASE_RESPONSE_PACKET_VERSION, exactKeys: true,
+    extensionPolicy: 'reject', futureVersionBehaviour: 'reject', migrationTarget: null,
+    canonicalisation: 'sorted-json-v2',
+    byteBudget: null,
+}));
+const workspaceContracts = SUPPORTED_WORKSPACE_ARCHIVE_VERSIONS.map((version) => lifecycleContract({
+    compatibilityId: WORKSPACE_ARCHIVE_COMPATIBILITY.id, schema: WORKSPACE_ARCHIVE_SCHEMA, version,
+    lifecycle: version === WORKSPACE_ARCHIVE_VERSION ? 'current' : 'legacy', readable: true,
+    emitted: version === WORKSPACE_ARCHIVE_VERSION, exactKeys: true, extensionPolicy: 'reject',
+    futureVersionBehaviour: 'reject', migrationTarget: version === WORKSPACE_ARCHIVE_VERSION
+        ? null
+        : { schema: WORKSPACE_ARCHIVE_SCHEMA, version: WORKSPACE_ARCHIVE_VERSION },
+    canonicalisation: 'workspace-section-sorted-json-v1', byteBudget: MAX_WORKSPACE_ARCHIVE_BYTES,
+}));
+function shape(id, schema, versions, requiredKeys, normalisation, target = null) {
+    return {
+        id,
+        schema,
+        versions,
+        objects: [{
+                path: '$',
+                requiredKeys,
+                alternativeRequiredKeys: [],
+                optionalKeys: schema === CASE_EXPORT_LIFECYCLE_SCHEMA ? ['exportedAt'] : [],
+                unknownKeys: schema === CASE_BROWSER_STORE_LIFECYCLE_SCHEMA ? 'discard_bounded' : 'reject',
+            }],
+        fixedArrays: [],
+        normalisation,
+        target,
+        discriminator: null,
+    };
+}
+const CASE_LIFECYCLE_SHAPES = Object.freeze([
+    shape('case.browser-store.public', CASE_BROWSER_STORE_LIFECYCLE_SCHEMA, [PUBLIC_CASE_SCHEMA_VERSION], ['version', 'cases'], 'project_known_fields'),
+    shape('case.browser-store.current', CASE_BROWSER_STORE_LIFECYCLE_SCHEMA, [CASE_SCHEMA_VERSION], ['version', 'cases'], 'project_known_fields'),
+    shape('case.export.public', CASE_EXPORT_LIFECYCLE_SCHEMA, [PUBLIC_CASE_SCHEMA_VERSION], ['version', 'cases'], 'preserve_document'),
+    shape('case.response-packet.v6', CASE_RESPONSE_PACKET_SCHEMA, [PUBLIC_CASE_RESPONSE_PACKET_VERSION], [
+        'schema', 'schemaVersion', 'generatedAt', 'reviewRequired', 'submissionPerformed',
+        'profile', 'case', 'incident', 'contacts', 'preflight', 'escalationHistory',
+        'provenance', 'integrity',
+    ], 'preserve_signed_document'),
+    shape('case.export.current', CASE_EXPORT_LIFECYCLE_SCHEMA, [CASE_SCHEMA_VERSION], ['version', 'cases'], 'preserve_document'),
+    shape('case.report.v9', CASE_REPORT_SCHEMA, [CASE_REPORT_SCHEMA_VERSION], ['schema', 'schemaVersion', 'generatedAt', 'application', 'case', 'currentAssessment', 'evidenceTimeline', 'analystResponse', 'responseLifecycle', 'limitations'], 'preserve_document'),
+    shape('case.response-packet.v7', CASE_RESPONSE_PACKET_SCHEMA, [CASE_RESPONSE_PACKET_VERSION], [
+        'schema', 'schemaVersion', 'generatedAt', 'reviewRequired', 'submissionPerformed',
+        'profile', 'case', 'incident', 'contacts', 'provenance', 'selectedEvidence',
+        'contradictions', 'readiness', 'artefactReferences', 'preflight', 'escalationHistory',
+        'escalationHistoryOmitted', 'escalationHistoryLimitations', 'responseLifecycle',
+        'authorisation', 'integrity',
+    ], 'preserve_signed_document'),
+    shape('case.response-review-inputs.v1', CASE_RESPONSE_REVIEW_INPUTS_SCHEMA, [CASE_RESPONSE_REVIEW_INPUTS_VERSION], [
+        'contract', 'version', 'profile', 'case', 'incident', 'contacts', 'selectedEvidence',
+        'contradictions', 'readiness', 'artefactReferences', 'escalationHistory',
+        'escalationHistoryOmitted', 'escalationHistoryLimitations', 'responseLifecycle',
+    ], 'preserve_signed_document'),
+    shape('case.cli-pack.current', CLI_CASE_PACK_SCHEMA, [CLI_CASE_PACK_VERSION], CLI_CASE_PACK_ROOT_KEYS, 'preserve_signed_document'),
+    shape('case.workspace-archive.v5', WORKSPACE_ARCHIVE_SCHEMA, [5], ['schema', 'version', 'generatedAt', 'manifest', 'sections', 'limitations'], 'preserve_signed_document'),
+    shape('case.workspace-archive.v6', WORKSPACE_ARCHIVE_SCHEMA, [WORKSPACE_ARCHIVE_VERSION], ['schema', 'version', 'generatedAt', 'manifest', 'sections', 'limitations'], 'preserve_signed_document'),
+    shape('case.workspace-settings.v1', WORKSPACE_SETTINGS_SCHEMA, [WORKSPACE_SETTINGS_VERSION], ['schema', 'version', 'activeProfileId', 'theme'], 'preserve_document'),
+    shape('case.encrypted-workspace-archive.v1', ENCRYPTED_WORKSPACE_ARCHIVE_SCHEMA, [ENCRYPTED_WORKSPACE_ARCHIVE_VERSION], ['schema', 'version', 'createdAt', 'content', 'kdf', 'cipher', 'ciphertext'], 'preserve_signed_document'),
+]);
+const CASE_LIFECYCLE_HOOKS = Object.freeze([
+    {
+        id: 'case.browser.normalise',
+        role: 'normaliser',
+        runtime: 'shared',
+        module: 'packages/cases/case-model.mts',
+        exportName: 'normalizeCaseStore',
+    },
+    {
+        id: 'case.browser.serialise',
+        role: 'serialiser',
+        runtime: 'shared',
+        module: 'packages/cases/case-model.mts',
+        exportName: 'serializeCaseStore',
+    },
+    {
+        id: 'case.export.merge',
+        role: 'merger',
+        runtime: 'shared',
+        module: 'packages/cases/case-model.mts',
+        exportName: 'mergeCases',
+    },
+    {
+        id: 'case.export.build',
+        role: 'builder',
+        runtime: 'shared',
+        module: 'packages/cases/case-model.mts',
+        exportName: 'buildCaseExport',
+    },
+    {
+        id: 'case.portable.serialise',
+        role: 'serialiser',
+        runtime: 'shared',
+        module: CASE_CONTRACT_OWNER,
+        exportName: 'serialiseCasePortableJson',
+    },
+    {
+        id: 'case.report.build',
+        role: 'builder',
+        runtime: 'shared',
+        module: 'packages/cases/case-report.mts',
+        exportName: 'buildCaseReport',
+    },
+    {
+        id: 'case.packet.build',
+        role: 'builder',
+        runtime: 'shared',
+        module: 'packages/cases/case-response-packet.mts',
+        exportName: 'buildCaseResponsePacket',
+    },
+    {
+        id: 'case.packet.verify',
+        role: 'integrity_verifier',
+        runtime: 'shared',
+        module: 'packages/cases/case-response-packet.mts',
+        exportName: 'verifyCaseResponsePacketIntegrity',
+    },
+    {
+        id: 'case.packet.structure',
+        role: 'structure_validator',
+        runtime: 'cli',
+        module: 'cli/artifact-structure.mts',
+        exportName: 'validateOfflineArtifactStructure',
+    },
+    {
+        id: 'case.review-inputs.build',
+        role: 'builder',
+        runtime: 'shared',
+        module: 'packages/cases/case-response-packet.mts',
+        exportName: 'buildCaseResponseReviewInputs',
+    },
+    {
+        id: 'case.review-inputs.validate',
+        role: 'structure_validator',
+        runtime: 'shared',
+        module: 'packages/cases/case-response-packet.mts',
+        exportName: 'validateCaseResponseReviewInputs',
+    },
+    {
+        id: 'case.cli-pack.build',
+        role: 'builder',
+        runtime: 'cli',
+        module: 'cli/case-pack.mts',
+        exportName: 'buildCliCasePack',
+    },
+    {
+        id: 'case.cli-pack.verify',
+        role: 'integrity_verifier',
+        runtime: 'cli',
+        module: 'cli/case-pack.mts',
+        exportName: 'verifyCliCasePack',
+    },
+    {
+        id: 'case.cli-pack.serialise',
+        role: 'serialiser',
+        runtime: 'cli',
+        module: 'cli/case-pack.mts',
+        exportName: 'formatCliCasePack',
+    },
+    {
+        id: 'case.workspace.build',
+        role: 'builder',
+        runtime: 'shared',
+        module: 'packages/workspace/workspace-archive.mts',
+        exportName: 'buildWorkspaceArchive',
+    },
+    {
+        id: 'case.workspace.verify',
+        role: 'integrity_verifier',
+        runtime: 'shared',
+        module: 'packages/workspace/workspace-archive.mts',
+        exportName: 'readWorkspaceArchive',
+    },
+    {
+        id: 'case.encrypted-workspace.build',
+        role: 'builder',
+        runtime: 'shared',
+        module: 'packages/workspace/workspace-archive-crypto.mts',
+        exportName: 'encryptWorkspaceArchive',
+    },
+    {
+        id: 'case.encrypted-workspace.verify',
+        role: 'integrity_verifier',
+        runtime: 'shared',
+        module: 'packages/workspace/workspace-archive-crypto.mts',
+        exportName: 'decryptWorkspaceArchive',
+    },
+]);
+const CASE_LIFECYCLE_BOUNDS = Object.freeze([
+    {
+        id: 'case.browser-store.bounds',
+        bounds: [
+            { id: 'raw-bytes', path: '$', phase: 'raw_intake', unit: 'bytes', minimum: 1, maximum: MAX_CASE_STORE_BYTES, handling: 'reject' },
+            { id: 'serialised-bytes', path: '$', phase: 'serialised', unit: 'bytes', minimum: 1, maximum: MAX_CASE_STORE_BYTES, handling: 'reject' },
+        ],
+    },
+    {
+        id: 'case.portable.bounds',
+        bounds: [
+            { id: 'raw-bytes', path: '$', phase: 'raw_intake', unit: 'bytes', minimum: 1, maximum: MAX_CASE_IMPORT_BYTES, handling: 'reject' },
+            { id: 'serialised-bytes', path: '$', phase: 'serialised', unit: 'bytes', minimum: 1, maximum: MAX_CASE_IMPORT_BYTES, handling: 'reject' },
+        ],
+    },
+    {
+        id: 'case.domain.bounds',
+        bounds: [
+            { id: 'cases', path: 'cases', phase: 'normalised', unit: 'items', minimum: 0, maximum: MAX_CASES, handling: 'truncate' },
+            { id: 'notes', path: 'cases[].notes', phase: 'normalised', unit: 'items', minimum: 0, maximum: MAX_NOTES_PER_CASE, handling: 'truncate' },
+            { id: 'evidence-history', path: 'cases[].evidenceHistory', phase: 'normalised', unit: 'items', minimum: 0, maximum: MAX_EVIDENCE_SNAPSHOTS_PER_CASE, handling: 'truncate' },
+            { id: 'actions', path: 'cases[].actions', phase: 'normalised', unit: 'items', minimum: 0, maximum: MAX_CASE_ACTIONS, handling: 'truncate' },
+            { id: 'action-events', path: 'cases[].actions[].history', phase: 'normalised', unit: 'items', minimum: 0, maximum: MAX_CASE_ACTION_EVENTS_PER_ACTION, handling: 'truncate' },
+        ],
+    },
+    {
+        id: 'case.packet.bounds',
+        bounds: [
+            { id: 'contacts', path: 'contacts', phase: 'normalised', unit: 'items', minimum: 0, maximum: MAX_RESPONSE_CONTACTS, handling: 'truncate' },
+            { id: 'urls', path: 'incident.abusiveUrls', phase: 'normalised', unit: 'items', minimum: 0, maximum: MAX_ABUSIVE_URLS, handling: 'truncate' },
+            { id: 'selected-evidence', path: 'selectedEvidence', phase: 'normalised', unit: 'items', minimum: 0, maximum: MAX_RESPONSE_SELECTED_EVIDENCE, handling: 'truncate' },
+            { id: 'contradictions', path: 'contradictions', phase: 'normalised', unit: 'items', minimum: 0, maximum: MAX_RESPONSE_CONTRADICTIONS, handling: 'truncate' },
+            { id: 'artefact-references', path: 'artefactReferences', phase: 'normalised', unit: 'items', minimum: 0, maximum: MAX_RESPONSE_ARTEFACT_REFERENCES, handling: 'truncate' },
+            { id: 'escalation-history', path: 'escalationHistory', phase: 'normalised', unit: 'items', minimum: 0, maximum: MAX_RESPONSE_ACTION_HISTORY, handling: 'truncate' },
+        ],
+    },
+    {
+        id: 'case.cli-pack.bounds',
+        bounds: [
+            { id: 'cases', path: 'cases', phase: 'normalised', unit: 'items', minimum: 1, maximum: MAX_CASE_PACK_CASES, handling: 'reject' },
+            { id: 'reports', path: 'packet.reports', phase: 'normalised', unit: 'items', minimum: 1, maximum: MAX_CASE_PACK_CASES, handling: 'reject' },
+        ],
+    },
+    {
+        id: 'case.workspace.bounds',
+        bounds: [
+            { id: 'raw-bytes', path: '$', phase: 'raw_intake', unit: 'bytes', minimum: 1, maximum: MAX_WORKSPACE_ARCHIVE_BYTES, handling: 'reject' },
+            { id: 'serialised-bytes', path: '$', phase: 'serialised', unit: 'bytes', minimum: 1, maximum: MAX_WORKSPACE_ARCHIVE_BYTES, handling: 'reject' },
+            { id: 'sections', path: 'manifest.sections', phase: 'pre_accumulation', unit: 'items', minimum: 1, maximum: MAX_WORKSPACE_ARCHIVE_SECTIONS, handling: 'reject' },
+            { id: 'section-bytes', path: 'manifest.sections[].bytes', phase: 'pre_accumulation', unit: 'bytes', minimum: 0, maximum: MAX_WORKSPACE_ARCHIVE_SECTION_BYTES, handling: 'reject' },
+        ],
+    },
+    {
+        id: 'case.encrypted-workspace.bounds',
+        bounds: [
+            { id: 'raw-bytes', path: '$', phase: 'raw_intake', unit: 'bytes', minimum: 1, maximum: MAX_ENCRYPTED_WORKSPACE_ARCHIVE_BYTES, handling: 'reject' },
+            { id: 'serialised-bytes', path: '$', phase: 'serialised', unit: 'bytes', minimum: 1, maximum: MAX_ENCRYPTED_WORKSPACE_ARCHIVE_BYTES, handling: 'reject' },
+            { id: 'passphrase-characters', path: '$.passphrase', phase: 'action', unit: 'characters', minimum: MIN_WORKSPACE_ARCHIVE_PASSPHRASE_CHARACTERS, maximum: MAX_WORKSPACE_ARCHIVE_PASSPHRASE_BYTES, handling: 'reject' },
+            { id: 'passphrase-bytes', path: '$.passphrase', phase: 'action', unit: 'bytes', minimum: MIN_WORKSPACE_ARCHIVE_PASSPHRASE_CHARACTERS, maximum: MAX_WORKSPACE_ARCHIVE_PASSPHRASE_BYTES, handling: 'reject' },
+        ],
+    },
+]);
+const CASE_LIFECYCLE_PRIVACY = Object.freeze([
+    {
+        id: 'case.privacy.browser-state',
+        classification: 'analyst_authored_sensitive',
+        projection: 'browser_import',
+        includedCategories: ['case-identifiers', 'analyst-notes', 'bounded-evidence-summaries', 'exact-submitted-hostnames', 'response-history'],
+        excludedCategories: ['raw-upstream-payloads', 'credentials', 'cookies', 'session-data'],
+        notePolicy: 'allowed_bounded',
+        retention: 'browser_indexeddb',
+        network: 'none',
+        sharingReview: 'not_applicable',
+    },
+    {
+        id: 'case.privacy.portable-input',
+        classification: 'analyst_authored_sensitive',
+        projection: 'browser_import',
+        includedCategories: ['case-identifiers', 'bounded-case-records', 'exact-submitted-hostnames', 'declared-integrity'],
+        excludedCategories: ['raw-upstream-payloads', 'credentials', 'cookies', 'session-data'],
+        notePolicy: 'allowed_bounded',
+        retention: 'deliberate_local_file',
+        network: 'none',
+        sharingReview: 'required',
+    },
+    {
+        id: 'case.privacy.portable-output',
+        classification: 'analyst_authored_sensitive',
+        projection: 'browser_export',
+        includedCategories: ['case-identifiers', 'bounded-case-records', 'exact-submitted-hostnames', 'declared-integrity'],
+        excludedCategories: ['raw-upstream-payloads', 'credentials', 'cookies', 'session-data'],
+        notePolicy: 'allowed_bounded',
+        retention: 'operator_controlled_output',
+        network: 'none',
+        sharingReview: 'required',
+    },
+]);
+const EXPIRY_ID = 'case.expiry.not-applicable';
+const CASE_LIFECYCLE_EXPIRY = Object.freeze([{
+        id: EXPIRY_ID,
+        field: null,
+        anchor: null,
+        handling: 'not_applicable',
+        phase: 'not_applicable',
+        maximumLifetimeDays: null,
+    }]);
+const CASE_LIFECYCLE_SERIALISATION = Object.freeze([
+    {
+        id: 'case.browser-store.json.v13',
+        schema: CASE_BROWSER_STORE_LIFECYCLE_SCHEMA,
+        versions: [CASE_SCHEMA_VERSION],
+        mediaType: 'application/json',
+        encoding: 'utf-8',
+        bom: false,
+        indentSpaces: 2,
+        terminalLf: true,
+        propertyOrder: 'normalised_fixed',
+        canonicalisation: null,
+        integrity: 'none',
+        serializerHookId: 'case.browser.serialise',
+        verifierHookIds: [],
+    },
+    ...[
+        ['case.export.json.v13', CASE_EXPORT_LIFECYCLE_SCHEMA, [CASE_SCHEMA_VERSION], 'none', []],
+        ['case.report.json.v9', CASE_REPORT_SCHEMA, [CASE_REPORT_SCHEMA_VERSION], 'none', []],
+        ['case.packet.json.v7', CASE_RESPONSE_PACKET_SCHEMA, [...SUPPORTED_CASE_RESPONSE_PACKET_VERSIONS], 'structural_only_requires_separate_verification', ['case.packet.verify']],
+        ['case.workspace.json.v6', WORKSPACE_ARCHIVE_SCHEMA, [WORKSPACE_ARCHIVE_VERSION], 'structural_only_requires_separate_verification', ['case.workspace.verify']],
+        ['case.encrypted-workspace.json.v1', ENCRYPTED_WORKSPACE_ARCHIVE_SCHEMA, [ENCRYPTED_WORKSPACE_ARCHIVE_VERSION], 'structural_only_requires_separate_verification', ['case.encrypted-workspace.verify']],
+    ].map(([id, schema, versions, integrity, verifierHookIds]) => ({
+        id,
+        schema,
+        versions,
+        mediaType: 'application/json',
+        encoding: 'utf-8',
+        bom: false,
+        indentSpaces: 2,
+        terminalLf: true,
+        propertyOrder: 'normalised_fixed',
+        canonicalisation: null,
+        integrity,
+        serializerHookId: 'case.portable.serialise',
+        verifierHookIds,
+    })),
+    {
+        id: 'case.cli-pack.json.v2',
+        schema: CLI_CASE_PACK_SCHEMA,
+        versions: [...SUPPORTED_CLI_CASE_PACK_VERSIONS],
+        mediaType: 'application/json',
+        encoding: 'utf-8',
+        bom: false,
+        indentSpaces: 2,
+        terminalLf: true,
+        propertyOrder: 'normalised_fixed',
+        canonicalisation: null,
+        integrity: 'structural_only_requires_separate_verification',
+        serializerHookId: 'case.cli-pack.serialise',
+        verifierHookIds: ['case.cli-pack.verify'],
+    },
+]);
+const sharedEdge = {
+    expiryPolicyId: EXPIRY_ID,
+    requestMode: 'none',
+    bindingState: 'declared_unenforced',
+    policyState: 'current',
+};
+const CASE_LIFECYCLE_CONSUMERS = Object.freeze([
+    {
+        id: 'case.browser.read-write',
+        plane: 'browser',
+        operation: 'normalise-and-store',
+        acceptedContracts: [{
+                schema: CASE_BROWSER_STORE_LIFECYCLE_SCHEMA,
+                versions: [...CASE_BROWSER_SUPPORTED_VERSIONS],
+                mode: 'direct',
+                discriminator: null,
+            }],
+        emittedContract: { schema: CASE_BROWSER_STORE_LIFECYCLE_SCHEMA, version: CASE_SCHEMA_VERSION, discriminator: null },
+        shapeIds: ['case.browser-store.public', 'case.browser-store.current'],
+        boundProfileIds: ['case.browser-store.bounds', 'case.domain.bounds'],
+        hookIds: ['case.browser.normalise', 'case.browser.serialise'],
+        serialisationProfileId: 'case.browser-store.json.v13',
+        privacyProfileId: 'case.privacy.browser-state',
+        retentionEffect: 'browser_indexeddb',
+        ...sharedEdge,
+    },
+    {
+        id: 'case.export.import',
+        plane: 'shared',
+        operation: 'non-destructive-merge',
+        acceptedContracts: [{
+                schema: CASE_EXPORT_LIFECYCLE_SCHEMA,
+                versions: [...CASE_IMPORT_VERSIONS],
+                mode: 'direct',
+                discriminator: null,
+            }],
+        emittedContract: null,
+        shapeIds: ['case.export.public', 'case.export.current'],
+        boundProfileIds: ['case.portable.bounds', 'case.domain.bounds'],
+        hookIds: ['case.export.merge'],
+        serialisationProfileId: null,
+        privacyProfileId: 'case.privacy.portable-input',
+        retentionEffect: 'deliberate_local_file',
+        ...sharedEdge,
+    },
+    {
+        id: 'case.consumer.export-build',
+        plane: 'shared',
+        operation: 'build-portable-export',
+        acceptedContracts: [],
+        emittedContract: { schema: CASE_EXPORT_LIFECYCLE_SCHEMA, version: CASE_SCHEMA_VERSION, discriminator: null },
+        shapeIds: ['case.export.current'],
+        boundProfileIds: ['case.portable.bounds', 'case.domain.bounds'],
+        hookIds: ['case.export.build', 'case.portable.serialise'],
+        serialisationProfileId: 'case.export.json.v13',
+        privacyProfileId: 'case.privacy.portable-output',
+        retentionEffect: 'operator_controlled_output',
+        ...sharedEdge,
+    },
+    {
+        id: 'case.consumer.report-build',
+        plane: 'shared',
+        operation: 'build-report',
+        acceptedContracts: [],
+        emittedContract: { schema: CASE_REPORT_SCHEMA, version: CASE_REPORT_SCHEMA_VERSION, discriminator: null },
+        shapeIds: ['case.report.v9'],
+        boundProfileIds: ['case.domain.bounds'],
+        hookIds: ['case.report.build', 'case.portable.serialise'],
+        serialisationProfileId: 'case.report.json.v9',
+        privacyProfileId: 'case.privacy.portable-output',
+        retentionEffect: 'operator_controlled_output',
+        ...sharedEdge,
+    },
+    {
+        id: 'case.consumer.packet-verify',
+        plane: 'shared',
+        operation: 'verify-integrity',
+        acceptedContracts: [{
+                schema: CASE_RESPONSE_PACKET_SCHEMA,
+                versions: [...SUPPORTED_CASE_RESPONSE_PACKET_VERSIONS],
+                mode: 'direct',
+                discriminator: null,
+            }],
+        emittedContract: null,
+        shapeIds: ['case.response-packet.v6', 'case.response-packet.v7'],
+        boundProfileIds: ['case.packet.bounds'],
+        hookIds: ['case.packet.verify'],
+        serialisationProfileId: null,
+        privacyProfileId: 'case.privacy.portable-input',
+        retentionEffect: 'deliberate_local_file',
+        ...sharedEdge,
+    },
+    {
+        id: 'case.consumer.packet-offline-verify',
+        plane: 'cli',
+        operation: 'validate-structure-and-integrity',
+        acceptedContracts: [{
+                schema: CASE_RESPONSE_PACKET_SCHEMA,
+                versions: [...SUPPORTED_CASE_RESPONSE_PACKET_VERSIONS],
+                mode: 'direct',
+                discriminator: null,
+            }],
+        emittedContract: null,
+        shapeIds: ['case.response-packet.v6', 'case.response-packet.v7'],
+        boundProfileIds: ['case.packet.bounds'],
+        hookIds: ['case.packet.structure', 'case.packet.verify'],
+        serialisationProfileId: null,
+        privacyProfileId: 'case.privacy.portable-input',
+        retentionEffect: 'deliberate_local_file',
+        ...sharedEdge,
+    },
+    {
+        id: 'case.consumer.packet-build',
+        plane: 'shared',
+        operation: 'build-packet',
+        acceptedContracts: [],
+        emittedContract: { schema: CASE_RESPONSE_PACKET_SCHEMA, version: CASE_RESPONSE_PACKET_VERSION, discriminator: null },
+        shapeIds: ['case.response-packet.v7'],
+        boundProfileIds: ['case.packet.bounds'],
+        hookIds: ['case.packet.build', 'case.portable.serialise'],
+        serialisationProfileId: 'case.packet.json.v7',
+        privacyProfileId: 'case.privacy.portable-output',
+        retentionEffect: 'operator_controlled_output',
+        ...sharedEdge,
+    },
+    {
+        id: 'case.consumer.review-inputs-validate',
+        plane: 'shared',
+        operation: 'validate-review-inputs',
+        acceptedContracts: [{
+                schema: CASE_RESPONSE_REVIEW_INPUTS_SCHEMA,
+                versions: [CASE_RESPONSE_REVIEW_INPUTS_VERSION],
+                mode: 'direct',
+                discriminator: null,
+            }],
+        emittedContract: null,
+        shapeIds: ['case.response-review-inputs.v1'],
+        boundProfileIds: ['case.packet.bounds'],
+        hookIds: ['case.review-inputs.validate'],
+        serialisationProfileId: null,
+        privacyProfileId: 'case.privacy.portable-input',
+        retentionEffect: 'deliberate_local_file',
+        ...sharedEdge,
+    },
+    {
+        id: 'case.consumer.review-inputs-build',
+        plane: 'shared',
+        operation: 'build-review-inputs',
+        acceptedContracts: [],
+        emittedContract: {
+            schema: CASE_RESPONSE_REVIEW_INPUTS_SCHEMA,
+            version: CASE_RESPONSE_REVIEW_INPUTS_VERSION,
+            discriminator: null,
+        },
+        shapeIds: ['case.response-review-inputs.v1'],
+        boundProfileIds: ['case.packet.bounds'],
+        hookIds: ['case.review-inputs.build'],
+        serialisationProfileId: null,
+        privacyProfileId: 'case.privacy.portable-output',
+        retentionEffect: 'operator_controlled_output',
+        ...sharedEdge,
+    },
+    {
+        id: 'case.consumer.cli-pack-verify',
+        plane: 'cli',
+        operation: 'verify-case-pack',
+        acceptedContracts: [{
+                schema: CLI_CASE_PACK_SCHEMA,
+                versions: [...SUPPORTED_CLI_CASE_PACK_VERSIONS],
+                mode: 'direct',
+                discriminator: null,
+            }],
+        emittedContract: null,
+        shapeIds: ['case.cli-pack.current'],
+        boundProfileIds: ['case.portable.bounds', 'case.cli-pack.bounds'],
+        hookIds: ['case.cli-pack.verify'],
+        serialisationProfileId: null,
+        privacyProfileId: 'case.privacy.portable-input',
+        retentionEffect: 'deliberate_local_file',
+        ...sharedEdge,
+    },
+    {
+        id: 'case.consumer.cli-pack-build',
+        plane: 'cli',
+        operation: 'build-case-pack',
+        acceptedContracts: [{
+                schema: CASE_EXPORT_LIFECYCLE_SCHEMA,
+                versions: [CASE_SCHEMA_VERSION],
+                mode: 'direct',
+                discriminator: null,
+            }],
+        emittedContract: { schema: CLI_CASE_PACK_SCHEMA, version: CLI_CASE_PACK_VERSION, discriminator: null },
+        shapeIds: ['case.export.current', 'case.cli-pack.current'],
+        boundProfileIds: ['case.portable.bounds', 'case.domain.bounds', 'case.cli-pack.bounds'],
+        hookIds: ['case.cli-pack.build', 'case.cli-pack.serialise'],
+        serialisationProfileId: 'case.cli-pack.json.v2',
+        privacyProfileId: 'case.privacy.portable-output',
+        retentionEffect: 'operator_controlled_output',
+        ...sharedEdge,
+    },
+    {
+        id: 'case.consumer.workspace-verify',
+        plane: 'browser',
+        operation: 'verify-and-preview-workspace',
+        acceptedContracts: [{
+                schema: WORKSPACE_ARCHIVE_SCHEMA,
+                versions: [...SUPPORTED_WORKSPACE_ARCHIVE_VERSIONS],
+                mode: 'direct',
+                discriminator: null,
+            }, {
+                schema: WORKSPACE_SETTINGS_SCHEMA,
+                versions: [WORKSPACE_SETTINGS_VERSION],
+                mode: 'embedded',
+                discriminator: null,
+            }],
+        emittedContract: null,
+        shapeIds: ['case.workspace-archive.v5', 'case.workspace-archive.v6', 'case.workspace-settings.v1'],
+        boundProfileIds: ['case.workspace.bounds'],
+        hookIds: ['case.workspace.verify'],
+        serialisationProfileId: null,
+        privacyProfileId: 'case.privacy.portable-input',
+        retentionEffect: 'deliberate_local_file',
+        ...sharedEdge,
+    },
+    {
+        id: 'case.consumer.workspace-build',
+        plane: 'browser',
+        operation: 'build-workspace',
+        acceptedContracts: [],
+        emittedContract: { schema: WORKSPACE_ARCHIVE_SCHEMA, version: WORKSPACE_ARCHIVE_VERSION, discriminator: null },
+        shapeIds: ['case.workspace-archive.v6'],
+        boundProfileIds: ['case.workspace.bounds'],
+        hookIds: ['case.workspace.build', 'case.portable.serialise'],
+        serialisationProfileId: 'case.workspace.json.v6',
+        privacyProfileId: 'case.privacy.portable-output',
+        retentionEffect: 'operator_controlled_output',
+        ...sharedEdge,
+    },
+    {
+        id: 'case.consumer.workspace-settings-build',
+        plane: 'browser',
+        operation: 'build-workspace-settings-section',
+        acceptedContracts: [],
+        emittedContract: { schema: WORKSPACE_SETTINGS_SCHEMA, version: WORKSPACE_SETTINGS_VERSION, discriminator: null },
+        shapeIds: ['case.workspace-settings.v1'],
+        boundProfileIds: ['case.workspace.bounds'],
+        hookIds: ['case.workspace.build'],
+        serialisationProfileId: null,
+        privacyProfileId: 'case.privacy.portable-output',
+        retentionEffect: 'operator_controlled_output',
+        ...sharedEdge,
+    },
+    {
+        id: 'case.consumer.encrypted-workspace-verify',
+        plane: 'browser',
+        operation: 'decrypt-and-verify-workspace',
+        acceptedContracts: [{
+                schema: ENCRYPTED_WORKSPACE_ARCHIVE_SCHEMA,
+                versions: [ENCRYPTED_WORKSPACE_ARCHIVE_VERSION],
+                mode: 'direct',
+                discriminator: null,
+            }],
+        emittedContract: null,
+        shapeIds: ['case.encrypted-workspace-archive.v1'],
+        boundProfileIds: ['case.encrypted-workspace.bounds'],
+        hookIds: ['case.encrypted-workspace.verify'],
+        serialisationProfileId: null,
+        privacyProfileId: 'case.privacy.portable-input',
+        retentionEffect: 'deliberate_local_file',
+        ...sharedEdge,
+    },
+    {
+        id: 'case.consumer.encrypted-workspace-build',
+        plane: 'browser',
+        operation: 'encrypt-workspace',
+        acceptedContracts: [{
+                schema: WORKSPACE_ARCHIVE_SCHEMA,
+                versions: [...SUPPORTED_WORKSPACE_ARCHIVE_VERSIONS],
+                mode: 'direct',
+                discriminator: null,
+            }],
+        emittedContract: {
+            schema: ENCRYPTED_WORKSPACE_ARCHIVE_SCHEMA,
+            version: ENCRYPTED_WORKSPACE_ARCHIVE_VERSION,
+            discriminator: null,
+        },
+        shapeIds: ['case.workspace-archive.v5', 'case.workspace-archive.v6', 'case.encrypted-workspace-archive.v1'],
+        boundProfileIds: ['case.workspace.bounds', 'case.encrypted-workspace.bounds'],
+        hookIds: ['case.encrypted-workspace.build', 'case.portable.serialise'],
+        serialisationProfileId: 'case.encrypted-workspace.json.v1',
+        privacyProfileId: 'case.privacy.portable-output',
+        retentionEffect: 'operator_controlled_output',
+        ...sharedEdge,
+    },
+]);
+export const CASE_PORTABILITY_LIFECYCLE_FAMILY = defineSchemaLifecycleFamily({
+    id: 'case-portability',
+    owner: CASE_CONTRACT_OWNER,
+    privacy: 'analyst_authored_sensitive',
+    compatibility: CASE_PORTABILITY_COMPATIBILITY,
+    contracts: [
+        ...browserContracts,
+        ...exportContracts,
+        ...reportContracts,
+        ...packetContracts,
+        lifecycleContract({
+            compatibilityId: CASE_RESPONSE_REVIEW_INPUTS_COMPATIBILITY.id,
+            schema: CASE_RESPONSE_REVIEW_INPUTS_SCHEMA,
+            version: CASE_RESPONSE_REVIEW_INPUTS_VERSION,
+            lifecycle: 'current',
+            readable: true,
+            emitted: true,
+            exactKeys: true,
+            extensionPolicy: 'reject',
+            futureVersionBehaviour: 'reject',
+            migrationTarget: null,
+            canonicalisation: 'sorted-json-v2',
+            byteBudget: null,
+        }),
+        lifecycleContract({
+            compatibilityId: CLI_CASE_PACK_COMPATIBILITY.id,
+            schema: CLI_CASE_PACK_SCHEMA,
+            version: CLI_CASE_PACK_VERSION,
+            lifecycle: 'current',
+            readable: true,
+            emitted: true,
+            exactKeys: true,
+            extensionPolicy: 'reject',
+            futureVersionBehaviour: 'reject',
+            migrationTarget: null,
+            canonicalisation: 'sorted-json-v2',
+            byteBudget: MAX_CASE_IMPORT_BYTES,
+        }),
+        ...workspaceContracts,
+        lifecycleContract({
+            compatibilityId: WORKSPACE_SETTINGS_COMPATIBILITY.id,
+            schema: WORKSPACE_SETTINGS_SCHEMA,
+            version: WORKSPACE_SETTINGS_VERSION,
+            lifecycle: 'current',
+            readable: true,
+            emitted: true,
+            exactKeys: true,
+            extensionPolicy: 'reject',
+            futureVersionBehaviour: 'reject',
+            migrationTarget: null,
+            canonicalisation: null,
+            byteBudget: null,
+        }),
+        lifecycleContract({
+            compatibilityId: ENCRYPTED_WORKSPACE_ARCHIVE_COMPATIBILITY.id,
+            schema: ENCRYPTED_WORKSPACE_ARCHIVE_SCHEMA,
+            version: ENCRYPTED_WORKSPACE_ARCHIVE_VERSION,
+            lifecycle: 'current',
+            readable: true,
+            emitted: true,
+            exactKeys: true,
+            extensionPolicy: 'reject',
+            futureVersionBehaviour: 'reject',
+            migrationTarget: null,
+            canonicalisation: 'aes-gcm-v1',
+            byteBudget: MAX_ENCRYPTED_WORKSPACE_ARCHIVE_BYTES,
+        }),
+    ],
+    fixtures: CASE_LIFECYCLE_FIXTURES,
+    metadata: {
+        metadataVersion: 4,
+        enforcement: 'declarative_only',
+        shapes: CASE_LIFECYCLE_SHAPES,
+        boundProfiles: CASE_LIFECYCLE_BOUNDS,
+        hooks: CASE_LIFECYCLE_HOOKS,
+        serialisationProfiles: CASE_LIFECYCLE_SERIALISATION,
+        privacyProfiles: CASE_LIFECYCLE_PRIVACY,
+        expiryProfiles: CASE_LIFECYCLE_EXPIRY,
+        consumerEdges: CASE_LIFECYCLE_CONSUMERS,
+        consumerRelationships: [],
+    },
+});